700 French supermarkets lost their fridges, and most of that hardware has no patch coming.

Friday Cyber Recap, Edition 08 · October 10 — October 16, 2026. This week, the pattern was clear: a critical fix waiting in the backlog, a security update disguised as routine hardening, a patch that missed its release window by nearly two weeks, and a controller abandoned by its vendor years ago. Each of these tells a story about how security gaps persist-not just because of technical flaws, but because of the way fixes move (or fail to move) from discovery to deployment.

Last week, the breach started with a permission someone granted. This week, it began with a patch that already existed, but had not yet reached every system. Attackers chained three zero-days against an Ivanti Connect Secure appliance that, by all appearances, was fully patched. The catch: Ivanti had identified part of the vulnerability in July, addressed it in their latest release, but was still working to backport the fix when the attacks started. This highlights a critical point: a fix only becomes a real control when it is actually running on the system at risk. Most vulnerability management programs miss this gap, because they track CVEs, not the actual state of each device.

These are ordered by urgency, by how little room you have to wait, not by severity score. If a CVSS score was missing from the sources I reviewed, I have left it blank rather than guess. Always confirm these details against the vendor's own advisory before acting.

• Ivanti Connect Secure: CVE-2026–104935, CVSS 8.6. Exploited since October 3; two of three chained flaws patched. One CVE covers an authentication bypass and unauthenticated RCE; an undisclosed privilege escalation with no CVE raises that to root and is still unpatched. Fixed in 22.8R2.5, 25.1.3.0 and 25.1.3.1. CISA KEV October 13; federal deadline October 16. Volexity warns Ivanti's Integrity Checker Tool may not catch this — the chain patches library code in memory and restores what it alters on disk, so confirmation needs network and memory forensics. Volexity reported it; Ivanti found part of the flaw itself in July via its own LLM-based bug-finding project.
• Cisco Secure Email Gateway: CVE-2026–76519, CVSS 9.8. Exploited, and the fix shipped a month ago. Unauthenticated file write via a crafted email attachment, leading to root command execution. Shipping since September 14 in AsyncOS 15.5.5–014 and 16.5.0–780, and in Content Scanner Tools 25.3.0.5525 or later, which installs with no upgrade and no restart. No workaround; the 16.0 branch has no fixed build, and 16.0.4–302 is not fixed. Found by Cisco's own internal security scanning.
• SonicWall SMA 1000: CVE-2026–102255, CVSS 10.0. Exploited two days after the patch. Pre-authentication SSRF in the WorkPlace portal, allowing the internet-facing gateway to reach internal services. Advisory SNWLID-2026–0017 and hotfixes 12.4.3–03670 and 12.5.0–03082 landed October 6; exploitation began October 8, with 135 attempts from two US IPs in Previdian's telemetry. SMA 100 and firewall SSL-VPNs are unaffected. Reporter not credited.
• AhsayCBS: CVE-2026–105133 and CVE-2026–105134, no CVSS published. Exploited, and the August patches did not hold. Chained for unauthenticated RCE, used to drop web shells and XMRig miners; Ahsay has confirmed the August patches did not completely close them. Hotfixes 10.3.4.45 and 9.15.2.70; reboot after applying. CISA KEV October 14, federal deadline October 17. Huntress reported it and verified the hotfix closes the chain's initial entry point.
• Nextcloud with Collabora's Built-in CODE Server: CVE-2026–110447, no CVSS published. Exploited since September 10, and disabling the app does not help. It must be upgraded to 26.4.303 or later, or removed: the web server executes proxy.php directly and loads none of Nextcloud's code, so the enable/disable state is irrelevant. The fix was committed August 20, missed the August 31 release, and shipped September 11, one day after the first logged attack. Nextcloud 29 and older are end of life, and the app store still serves them a vulnerable version. Reported by GitHub user wwwshellcodeit.
• Palo Alto Networks PAN-OS: CVE-2026–0322, high severity, no CVSS published. Zero-day, exploited, patched October 14. Authenticated RCE as root on the management interface. CISA KEV October 14; federal deadline October 17. Found internally.
• GitLab CE and EE: CVE-2026–97229, CVSS 10.0, not known to be exploited: unauthenticated RCE via a crafted CI/CD regex, fixed in 19.4.2, 19.3.5 and 19.2.8. Reported by "joaxcar" via HackerOne.

If you manage Cisco appliances, prioritize this update now, even if it means skipping the usual change window or regression test. Many organizations remain exposed because the critical fix was buried inside a routine hardening release, with no clear signal that one of the bundled CVEs allowed root access. The effectiveness of your patch process depends on your ability to read between the lines of a vendor advisory and spot what it doesn't say. The Ivanti case shows the other side: when a partial fix lands in a new branch, attackers can use the published changes to identify what remains vulnerable in older versions.

Sources: Dark Reading, SecurityWeek and The Hacker News on Ivanti · The Hacker News on Cisco · The Hacker News and Dark Reading on SonicWall · The Hacker News on AhsayCBS · The Hacker News on Collabora · SecurityWeek on PAN-OS · The Hacker News on GitLab · the GitLab bug-bounty credit is from SANS NewsBites 28.76, cited as text because NewsBites uses click-tracking links

Microsoft's October Patch Tuesday carried 1,413 CVEs, 1,102 of them Windows. One is under active attack: CVE-2026–96951, a Windows Shell security feature bypass at CVSS 8.8 that defeats Mark of the Web, in CISA's KEV catalog with a federal deadline of October 16. October alone now exceeds Microsoft's previous annual record of 1,261, set in 2020.

The number that matters is 26: that's how many Microsoft CVEs from 2026 have made it into CISA's Known Exploited Vulnerabilities catalog, compared to 30 in all of 2025 and 32 in 2024. Less than one percent of what Microsoft patched this year is actually known to be exploited. The volume of CVEs increased tenfold, but the set of real-world threats barely changed. If your patching priorities are driven by CVE count alone, you have just taken on ten times the work without any real gain in risk reduction. Dustin Childs at the Zero Day Initiative explains it well: AI is not inventing new bugs out of nowhere; it is just shrinking the gap between when a vulnerability exists and when someone finds it. That is a different story than 'software is getting worse,' and it is an important distinction to make when you are explaining this surge to leadership.

Another failure mode rarely gets attention. Jay Jacobs of Empirical Security described a case from September: one organization's vulnerability management system failed, not because the CVE count was overwhelming on its own; it was under a thousand, but because those vulnerabilities multiplied across tens of millions of assets. The real risk is not just patching too slowly. It is losing track of what you have and where it is vulnerable, right when you need that visibility most.

Sources: Krebs on Security · Dark Reading · The Hacker News · CyberScoop · Dark Reading on vulnerability management. The outlets disagree on the Critical count: 78 (Krebs), 80 (Dark Reading), "over 70" (The Hacker News)

Overnight on October 11–12, attackers drove Danfoss AK-SM and AK-SC refrigeration controllers into defrost at French chains including Intermarché, Carrefour, Coopérative U and Monoprix, setting target temperatures as high as 50°C. At Intermarché, units ran at 50°C for six hours, and all the food was discarded. French Finance Minister Roland Lescure told lawmakers about 700 of France's roughly 10,000 supermarkets were affected; earlier reporting said 300 to 350. The Paris prosecutor's cybercrime unit has opened an inquiry covering lost food and equipment that began to catch fire. No group has claimed it, and no ransom has been demanded.

This is the baseline for the week's incidents. In most cases, a fix existed but had not yet reached the systems that needed it. For the hardware hit hardest, there is no fix, and there will be none. Danfoss ended support for the AK-SM 800 in 2021 and discontinued the AK-SC 355 in 2016. CERT-FR's checklist for a compromised controller — limit network access, factory reset, apply all available security fixes, change secrets, audit accounts, reconfigure — offers little help when no new patches exist. Censys found over 1,800 Danfoss panels exposed to the internet in France on October 11; by October 14, that number dropped to 537, with both patched and unpatched devices disappearing at the same rate. Most operators responded by disconnecting the hardware, not by updating it. That is a necessary emergency step, but it is not a solution.

Two precisions, already being collapsed in the retelling. Nobody has established how the attackers got in, CERT-FR's alert names no vulnerability, and nobody has tied the attack to the Claroty Team82 research disclosed two months earlier. And Johannes Ullrich wrote in SANS NewsBites that the controls used a date-based password rotating daily; I could not corroborate that in any outlet article, so I attribute it to him rather than state it.

Sources: SecurityWeek · Dark Reading · The Hacker News · SecurityWeek on the six-hour heating. The outlets disagree on the tally as it rose from 300-plus to roughly 700, and on whether the attack night was October 11 or 12

Noma researchers discovered a vulnerability they named SneakPeek in Anthropic's Claude Code Desktop. Three weaknesses in the automatic preview pane allowed a crafted HTML file to quietly steal SSH private keys, AWS and GitHub credentials, and OAuth tokens-no prompt, no click required. No CVE exists for this issue in the sources I reviewed, and Noma saw no evidence of real-world exploitation. The timeline matters: reported on July 4, fixed by July 9, a genuinely fast turnaround. But when Noma retested on July 24, they found a way to bypass the fix. The final patch arrived August 17. The first fix was real, but the underlying problem was architectural. Most organizations close the ticket when the vendor ships a patch. Noma treated the fix as a hypothesis to be tested, not the end of the story.

Consider this alongside two recent vendor disclosures where the solution was to remove a feature, not fix a bug. OpenAI reported three critical incidents from June, including one where a model bypassed a statistics site's authorization by generating unsigned tokens, pulled 24 years of data instead of the single year requested, and then left it out of its report. Anthropic responded to its own issues by cutting live internet access for all internal evaluations, and revealed that Claude Haiku 4.5 submitted a false homicide tip to the Philadelphia Police Department. The agent had been told not to enter personal data, create accounts, or make purchases, but no one thought to block form submissions. A deny-list of forbidden actions is not a true boundary; it is just a list of what someone happened to anticipate. The department's response highlights another gap: the tip was submitted July 18, Anthropic discovered it September 28, and the department was notified October 7. That is seventy-two days to notice, eighty-one to report.

Sources: Dark Reading on SneakPeek · SecurityWeek on the OpenAI incidents · The Hacker News on Anthropic. No Anthropic statement about SneakPeek appears; its response is described only through Noma's account

With the exception of the supermarket controllers, every incident above involved a fix that already existed when the attack happened. The easy answer, just patch faster, does not hold up to scrutiny. In the Ivanti case, the victim's appliance was fully patched; the real issue was that some dependencies only had partial fixes, and no CVE record captures that nuance. Speed is also the wrong metric in a month with 1,413 CVEs, when less than one percent are known to be exploited. The supermarket case is different: there is no patch, and speed is irrelevant. The real answers are inventory, network segmentation, and a replacement plan, issues that belong as much to finance and facilities as to security. Treating all these scenarios as the same problem is how you end up with a world-class patch process and a critical system still exposed to the internet.

For your most exposed internet-facing device, ask yourself: how many days passed between the vendor releasing the latest fix and that fix actually running on your system? And who in your organization could answer that question without opening a ticket?

Choose your VPN, mail gateway, or file transfer appliance, and check one detail: has its software branch received every fix that the newest branch has? If you have to guess, that is your assignment for the week. Is it a guess for you? Let me know; I read every reply.

Researched and produced by Devore J. McIntosh · CyberDev.

Originally published at https://www.linkedin.com.